anyone know how to get the argv from pt_regs in execve hook
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 5d 13h
- Merged PRs (30d)
- 3
Description
i build hook for the execve system call and
I tried to copy the dp register (i saw it on assembly user space program)from the struct and then copy from the first address but it always empty
this is my code
`copy_from_user(mid,tr->bp,1);
strncpy_from_user(argv,mid[0], 100);
argv[99]='\0';
printk("cccc:%s\n",argv);
`
but when i run for example python3 b.py i dont see in the kernel log the b.py
but i do able to get the file that been execute in this case python3 from the bx register
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the execve hook and the pt_regs access shown in the issue, then verify how the argument pointer is represented and copied in this hook context. Reproduce the case with python3 b.py; done means the hook reliably logs both the executable and its argument without reading invalid or empty data.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100